C. M. v. MarinHealth Medical Group, Inc.

[3] 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA [6] 7 C. M., Case No. 23-cv-04179-WHO 8 Plaintiff, ORDER ON MOTION TO DISMISS v. [9] Re: Dkt. No. 22 10 MARINHEALTH MEDICAL GROUP, INC., [11] Defendant. [12] Defendant’s motion to dismiss claims four through nine of plaintiff’s complaint is [13] GRANTED on the negligence claim but DENIED as to the other challenged claims. [14] BACKGROUND 15 Plaintiff C.M. sues defendant MarinHealth Medical Group, Inc.1 for a number of privacy [16] right claims. Plaintiff alleges that MarinHealth failed “to implement adequate and reasonable [17] measures to ensure that the “personally identifiable information (‘PII’) and protected health [18] information (‘PHI’) (collectively, ‘Private Information’)” was protected and instead allowed [19] “unauthorized third parties, including Meta Platforms, Inc. d/b/a Facebook (“Facebook”) to [20] intercept” information regarding users’ use of defendants’ websites to seek healthcare related [21] services through implementation of Meta’s “Pixel” technology. Compl. ¶¶ 5-7. MarinHealth [22] moves to dismiss four of the nine causes of action alleged, seeking dismissal of the claims for: (1) [23] negligence; (2) breach of implied contract; (3) larceny, Cal. Penal Code § 496 (a)&(c); and (4) 24 unjust enrichment.2 [26] 1 Plaintiff alleges MarinHealth “is an organization consisting of three major divisions—a hospital, foundation, and network of expert clinicians—offering a wide range of clinical services to patients [27] in Northern California.” Compl. ¶¶ 1-4. 1 LEGAL STANDARD 2 Under FRCP 12(b)(6), a district court must dismiss a complaint if it fails to state a claim 3 upon which relief can be granted. To survive a Rule 12(b)(6) motion to dismiss, the plaintiff must 4 allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. 5 Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when the plaintiff pleads facts 6 that “allow the court to draw the reasonable inference that the defendant is liable for the 7 misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citation omitted). There 8 must be “more than a sheer possibility that a defendant has acted unlawfully.” Id. While courts 9 do not require “heightened fact pleading of specifics,” a plaintiff must allege facts sufficient to 10 “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555, 570 . 11 In deciding whether the plaintiff has stated a claim upon which relief can be granted, the 12 court accepts the plaintiff’s allegations as true and draws all reasonable inferences in favor of the 13 plaintiff. See Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). However, 14 the court is not required to accept as true “allegations that are merely conclusory, unwarranted 15 deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049 , 16 1055 (9th Cir. 2008). If the court dismisses the complaint, it “should grant leave to amend even if 17 no request to amend the pleading was made, unless it determines that the pleading could not 18 possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 19 2000). In making this determination, the court should consider factors such as “the presence or 20 absence of undue delay, bad faith, dilatory motive, repeated failure to cure deficiencies by 21 previous amendments, undue prejudice to the opposing party and futility of the proposed 22 amendment.” Moore v. Kayport Package Express, 885 F.2d 531 , 538 (9th Cir. 1989). 23 DISCUSSION 24 I. NEGLIGENCE 25 MarinHealth argues that the negligence claim must be dismissed because plaintiff did not [26] California Confidentiality of Medical Information Act (“CMIA”), Cal. Civ. Code § 56 , et seq.; (2) [27] Invasion of Privacy, Cal. Penal Code § 630 , et seq.; (3) California Unfair Competition Law, Cal. 1 allege nonspeculative negligence damages. Mot. 3-6; Reply at 1-4. Plaintiff responds that he has 2 satisfied that burden because he alleges that he was injured when his private information was 3 misused and that as a result he was subjected to and will continue to be subjected to unsolicited, 4 targeted advertising related to his specific medical conditions. Compl. ¶¶ 14, 111, 159. He also 5 alleges that he suffered a loss of the value of that private information and loss of control over the 6 same. Compl. ¶¶ 18, 223. 7 Defendant’s cases primarily deal with data breach scenarios that where there is no 8 evidence the plaintiff’s personal data was used for impermissible purposes,3 unlike here, where 9 plaintiff alleges that soon after visiting defendant’s website he started to receive ads targeted to his 10 medical conditions. Compl. ¶¶ 14, 111, 159. The alleged misuse of his personal data, therefore, is 11 not speculative. This allegation suffices for Article III standing. See, e.g., In re Facebook, Inc., 12 Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767 , 784 (N.D. Cal. 2019) (allegation “that 13 the plaintiffs’ sensitive information was disseminated to third parties in violation of their privacy – 14 is sufficient to confer standing,” but rejecting standing based on allegations regarding speculative 15 risk of identity theft and based on “diminution in value” absent plausible allegations that plaintiffs 16 “intended to sell their non-disclosed personal information to someone else”). 17 Neither side cites caselaw regarding whether a defendant’s conduct allowing third-party 18 access to sensitive information where the third-party then misuses the information, by itself, 19 supports the injury required for a negligence claim.4 With respect to the diminution in value [20] 3 See, e.g., Medoff v. Minka Lighting, LLC, No. 222CV08885SVWPVC, 2023 WL 4291973 , at *9 [21] (C.D. Cal. May 8, 2023) (alleged “increased risk of identity theft” did not amount to “appreciable, nonspeculative, present harm”); Razuki v. Caliber Home Loans, Inc., No. 17CV1718-LAB [22] (WVG), 2018 WL 6018361 , at *1 (S.D. Cal. Nov. 15, 2018 (allegations of “diminution in value of his personal data” and “continued risk to his financial information” insufficient because both [23] “stem[ed] from the danger of future harm”); In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 903 F. Supp. 2d 942, 963 (S.D. Cal. 2012 (allegations of “an increased risk of future [24] harm, [are] insufficient to sustain a negligence claim under California law.”). [25] 4 Plaintiff relies on In re Ambry Genetics Data Breach Litig., 567 F. Supp. 3d 1130 , 1142 (C.D. Cal. 2021), but there the allegations of injury from “unauthorized sharing of their private medical [26] information,” were combined with allegations regarding “anxiety, concern, and unease” and plaintiffs had “spent many hours responding to the data breach.” It is questionable whether the [27] wrongful dissemination of the sensitive data and the alleged “loss of control” over the sensitive 1 theory of injury, as I recognized in the related In re Meta Healthcare Litigation case, where “the 2 crux of this case concerns Meta’s receipt of ‘individually identifiable health information,’ that 3 plaintiffs apparently do not want Meta or anyone other than their healthcare providers to have” it 4 is incongruous for plaintiff “to then allege they intended to participate in this market, or otherwise 5 to derive economic value from their PII.” Doe v. Meta Platforms, Inc., No. 22-CV-03580-WHO, [6] 2023 WL 5837443 , at *17 (N.D. Cal. Sept. 7, 2023) (relying on Moore v. Centrelake Med. Grp., 7 Inc., 83 Cal. App. 5th 515 , 538 (2022), review denied (Dec. 14, 2022)). I recognize that discussion 8 was in the context of the “lost money or property” element for standing under California’s Unfair 9 Competition Law (“UCL,” Cal. Bus. & Prof. Code § 17200 ),5 but it would be incongruous for 10 plaintiff to allege an injury for negligence based on lost value of sensitive healthcare data. 11 Various Northern District cases have held that allegations of “lost time and expenses 12 Plaintiffs allege that they have already incurred due to the data breach,” can support a negligence 13 claim, as in that scenario “future expenses and time is not too speculative to constitute cognizable 14 injuries at the pleading stage.” Mehta v. Robinhood Fin. LLC, No. 21-CV-01013-SVK, 2021 WL 15 6882392, at *5 (N.D. Cal. Sept. 8, 2021); see also Huynh v. Quora, Inc., 508 F.Supp.3d 633 , 650 16 (N.D. Cal. 2020) (recognizing that allegations of lost time and money constitute cognizable 17 negligence harm). Plaintiff recognizes that he has not, yet, alleged lost time or expenses related to [19] was considering Article III standing and the viability of privacy-based claims even in the absence of economic loss. Id. at 784 (“courts have often held that this particular type of intangible injury – [20] disclosure of sensitive private information, even without further consequence – gives rise to Article III standing”); see also id. at 785-787 . [21] 5 See In re Facebook Priv. Litig., 791 F. Supp. 2d 705, 714 (N.D. Cal. 2011) (“A plaintiff's [22] ‘personal information’ does not constitute property under the UCL. . . . . Here, Plaintiffs do not allege that they lost money as a result of Defendant’s conduct.”). That decision was affirmed by [23] the Ninth Circuit, which reversed the dismissal of the breach of contract and fraud claims based on allegations of harm “both by the dissemination of their personal information and by losing the [24] sales value of that information.” In re Facebook Priv. Litig., 572 F. App'x 494 (9th Cir. 2014). However, the Ninth Circuit’s conclusion, with respect to the contract claim, is undermined by [25] more recent California authority. See Moore v. Centrelake Med. Grp., Inc., 83 Cal. App. 5th 515 , 538 (2022), review denied (Dec. 14, 2022) (rejecting “lost-value-of-PII theory” to support [26] standing for UCL and breach of contract claim, where plaintiffs failed to plead they “attempted or intended to participate in [the PII] market, or otherwise to derive economic value from their PII. [27] Nor did they allege that any prospective purchaser of their PII might learn that their PII had been 1 the use of his medical information shared by defendant, although he reserves his right to do so. 2 Oppo. at 6 n.7. 3 Plaintiff is given leave to amend to include his allegations regarding lost time and/or 4 expenses in responding to the plausibly alleged misuse of his medical information and any other 5 allegations that he believes support the required showing of injury to support his negligence claim. 6 The negligence claim is DISMISSED with leave to amend. 7 II. BREACH OF IMPLIED CONTRACT 8 “For a breach of an implied contract claim, a plaintiff must show: (1) a valid implied-in9 fact contract, (2) the plaintiff's performance or excuse for nonperformance, (3) the defendant's 10 breach of the agreement, and (4) resulting damages.” Westron v. Zoom Video Commc'ns, Inc., No. 11 22-CV-03147-YGR, 2023 WL 3149262 , at *2 (N.D. Cal. Feb. 15, 2023). Defendant argues that 12 plaintiff’s implied contract claim fails because plaintiff has not adequately alleged “loss of the 13 benefit of the bargain” damages. Mot. at 7. In his Complaint, plaintiff specifically alleges that: 14 280. When Plaintiff and Nationwide Class Members provided their Private Information to Defendant in exchange for services, they 15 entered into implied contracts by which Defendant agreed to safeguard and not disclose such Private Information without consent. [16] 281. Plaintiff and Nationwide Class Members accepted Defendant’s 17 offers of services and provided their Private Information to Defendant via the Web Properties. [18] 282. Plaintiff and Nationwide Class Members would not have 19 entrusted Defendant with their Private Information in the absence of an implied contract between them that included Defendant’s promise 20 not to disclose Private Information without consent. 21 283. Defendant breached these implied contracts by disclosing Plaintiff’s and Nationwide Class Members’ Private Information to 22 third parties, including Facebook. 23 Compl. ¶¶ 280-283. 24 In support of its argument, defendant cites a number of cases that have required plaintiffs 25 in data breach cases to allege specific “consideration” for the implied contract claim; meaning that 26 the plaintiff paid something more for the alleged security promises. See Ortiz v. Perkins & Co., 27 No. 22-CV-03506-KAW, 2022 WL 16637993 , at *6 (N.D. Cal. Nov. 2, 2022) (discussing cases); 1 Cal. Mar. 5, 2021) (rejecting implied contract claim where plaintiff did not allege that the 2 defendant represented that his “purchases included a sum understood by the parties to be allocated 3 toward customer data,” or “that the cost of the goods he purchased ... included some amount 4 attributable to data security as required to support his benefit of the bargain theory.”); In re 5 Linkedin User Privacy Litigation, 932 F. Supp. 2d 1089, 1093 (N.D. Cal. 2013) (while plaintiffs 6 had paid for a premium membership, “the bargain is not for a particular level of security, but 7 actually for the advanced networking tools and capabilities to facilitate enhanced usage of 8 LinkedIn’s services,” so the complaint “d[id] not sufficiently demonstrate that included in [the 9 p]laintiffs’ bargain for premium membership was the promise of a particular (or greater) level of 10 security that was not part of the free membership.”); Huynh v. Quora, Inc., No. 18-cv-07597-BLF, [11] 2019 WL 11502875 at *10 (N.D. Cal. Dec. 19, 2019) (finding no breach of contract claim where 12 the plaintiffs “ha[d] not shown that they paid anything for the asserted privacy protections”). 13 Plaintiff notes that in the majority of these cases there were multiple issues precluding the 14 claims. In Ortiz, for example, the implied breach claim was ultimately dismissed because plaintiff 15 failed “to allege a contract, implied or otherwise, in which Defendant agreed to provide data 16 security.” 2022 WL 16637993 , at *6. In Gardiner, the contract claim was dismissed because 17 plaintiff “does not allege facts that his Walmart purchases included a sum understood by the 18 parties to be allocated toward customer data protection nor does he allege that he was required to 19 agree to or accept the terms of the Privacy Policy prior to engaging in any purchase.” 2021 WL 20 2520103, at *6. In Huynh, the court concluded that “the lost benefit of the bargain is not sufficient 21 to allege damages because Plaintiffs have not shown that they paid anything for the asserted 22 privacy protections; indeed, Quora's services were free.” 2019 WL 11502875 , at *10. And in In 23 re LinkedIn, the benefit theory failed because “the User Agreement and Privacy Policy are the 24 same for the premium membership as they are for the nonpaying basic membership. Any alleged 25 promise LinkedIn made to paying premium account holders regarding security protocols was also 26 made to non-paying members.” 932 F. Supp. 2d at 1093 . 27 In contrast, this case arises in the context of paid healthcare services and is based on an 1 he paid for the services was based in part, on MarinHealth’s security promises. In this context, 2 adequate consideration has been alleged for the implied contract claim. See, e.g., Medoff v. Minka 3 Lighting, LLC, 2023 WL 4291973 , at *11 (“Plaintiff is contending that the safeguard of data was 4 an implied provision of the existing employment contract, which is supported by the consideration 5 that he provided as part of his employment contract—his labor.”); In re Ambry Genetics Data 6 Breach Litig., 567 F. Supp. 3d 1130 , 1144 (C.D. Cal. 2021) (claim sufficient where “[p]laintiffs 7 allege that they gave their private information to Defendants for purposes of obtaining genetic 8 testing, with the understanding that Defendants would take adequate measures to protect the 9 information.”).6 The motion to dismiss the breach of implied contract claim is DENIED. 10 III. LARCENY, CAL PENAL CODE 496(A)&(C) 11 Plaintiff’s larceny claim is brought under California Penal Code sections 496(a) & (c), on 12 the theory that MarinHealth “knew the Private Information” from C.M. and others was obtained 13 through “false pretenses” prohibited by Cal. Penal Code section 484 and that MarinHealth 14 transmitted the Private Information to “unauthorized third parties, like Facebook” or Google, and 15 “concealed, withheld, or aided in concealing or withholding” the Private Information from their 16 rightful owners. Compl., ¶¶ 291-295; see also Bell v. Feibush, 212 Cal. App. 4th 1041 , 1047-48 17 (2013) (discussing theft by false pretenses).7 Defendant makes a number of challenges to this 18 claim, each of which fail. 19 Initially, I need not address the possible extraterritorial scope of California’s larceny [21] 6 Some courts have expressly disagreed with Gardiner and the line of cases requiring identification of specific sums attributable to increased security representations. See, e.g., [22] Smallman v. MGM Resorts Int'l, 638 F. Supp. 3d 1175 , 1190 (D. Nev. 2022) (“The Court considers, but does not find persuasive, these cases ‘requiring allegations of a particular sum of the [23] purchase price being explicitly allocated for data security. That is requiring too much.’”); In re Intel Corp. CPU Mktg., Sales Pracs. & Prod. Liab. Litig., No. 3:18-MD-2828-SI, 2020 WL 24 1495304, at *8 (D. Or. Mar. 27, 2020), aff'd, No. 22-35652, 2023 WL 7211394 (9th Cir. Nov. 2, 2023) (finding “not find persuasive the cases requiring allegations of a particular sum of the [25] purchase price being explicitly allocated for data security. That is requiring too much. The Court finds more persuasive the line of cases that accept at the pleading stage more general factual [26] allegations about the plaintiff’s expectations for data security and the contours of the parties’ bargain.”). [27] 1 statute at this juncture. Plaintiff is a California resident, defendant is a California resident, and 2 Meta – the only entity alleged to have received the stolen information and which is alleged to have 3 designed and marketed the technology used to secure plaintiff’s information – is a California 4 resident. See Doe v. Meta Platforms, Inc., No. 22-CV-03580-WHO, 2023 WL 5837443 , at *6 5 (N.D. Cal. Sept. 7, 2023) (deferring extraterritoriality issue as arguably premature, where plaintiffs 6 plausibly alleged that the design and marketing of Meta’s Pixel technology occurred in California, 7 and where Facebook’s Terms of Service specify that California law applies to disputes between 8 Facebook and its users). Whether it is appropriate to certify a nationwide class that might include 9 absent class members who are residents of states other than California will be determined at class 10 certification.8 11 MarinHealth next contends that plaintiff’s continued use of the MarinHealth website 12 “invalidates” his claim for larceny. Plaintiff admits that he continues to submit information to 13 MarinHealth through MarinHealth’s website, so MarinHealth argues that since he now knows his 14 information is being stolen by MarinHealth and shared with Meta, he can no longer be “relying on 15 false pretenses” sufficient to state a larceny claim. Reply [Dkt. No. 33] 6-7. This argument may 16 work to cut off potential liability for larceny at some point in this case, perhaps to be raised at 17 summary judgment or trial, but it does not warrant dismissal of the larceny claim at the motion to 18 dismiss stage. 19 To plausibly state a claim of theft by false pretenses, plaintiff must allege that MarinHealth 20 made specific false representations to him and that plaintiff transferred his property “in reliance on 21 the representation.” See People v. Miller, 81 Cal. App. 4th 1427, 1440 (2000), as modified on 22 denial of reh'g (July 6, 2000). Here, plaintiff has identified the false pretenses and his reliance on 23 them. Compl. ¶ 17 n.4 (“MarinHealth’s Privacy Policies (and other affirmative representations) 24 represent to Users that it will not share Private Information for marketing purposes unless patients [26] 8 Dfinity USA Rsch. LLC v. Bravick, No. 22-CV-03732-EJD, 2023 WL 2717252 (N.D. Cal. Mar. 29, 2023) does not address a similar claim in a similar posture and is, therefore, inapposite. See id. [27] *5 (larceny claim “barred by the presumption against extraterritoriality” where the “wrongful 1 provide written permission [MarinHealth website Privacy Policy]); ¶¶ 95-98 (identifying specific 2 portions of Privacy Policy MarinHealth violated); ¶ 110 (“Plaintiff and Class Members relied to 3 their detriment on Defendant’s uniform representations and omissions regarding protection 4 privacy, limited uses, and lack of sharing of their Private Information”), ¶ 228 (“Plaintiff and 5 Nationwide Class Members reasonably relied upon the representations Defendant made in their 6 Privacy Policy, including those representations concerning the confidentiality of Private 7 Information, such as patient health information.”). That is sufficient. Defendant has adequate 8 notice of the bases of plaintiff’s larceny claim. There is nothing contradictory about plaintiff’s 9 admission that he continues to use defendant’s site to communicate about his healthcare that 10 would defeat this claim on a motion to dismiss.9 11 Lastly, defendant argues that plaintiff’s allegations regarding MarinHealth’s knowledge of 12 Meta’s receipt of its users’ personal information are insufficient to show “the type of willful 13 blindness contemplated by § 496, as opposed to mere negligence.” Nowak v. Xapo, Inc., No. 5:2014 CV-03643-BLF, 2020 WL 6822888 , at *2 (N.D. Cal. Nov. 20, 2020). However, plaintiff pleads 15 that despite MarinHealth’s alleged express and contradictory assertions to patients that it would 16 not share this type of information: it incorporated the Pixel and CAPI technology knowingly and 17 willfully into its websites; it knows that Meta uses the information secured to provide analytic 18 services back to MarinHealth about its website; and it knows Meta uses the information it secures 19 for marketing. Compl. ¶¶ 10, 40-44, 58, 170-171. This. That is sufficient. See Siry Inv., L.P. v. 20 Farkhondehpour, 13 Cal. 5th 333 , 362 (2022) (“In this case, the record appears consistent with a 21 conclusion that defendants acted not innocently or inadvertently, but with careful planning and 22 deliberation reflecting the requisite criminal intent.”). The motion to dismiss the larceny claim is 23 DENIED. [25] 9 That plaintiff alleges defendant allowed Meta’s Pixel to intercept his data, but that defendant [26] may also allow the “CAPI” workaround provided by Meta to connect directly with and receive marketing data from MarinHealth’s servers, does not undermine plaintiff’s larceny or other claims. [27] See Compl. ¶¶ 41-46; Reply 8-10. Whether defendant allows Meta access to its users’ personal IV. UNJUST ENRICHMENT [1] Finally, MarinHealth moves to dismiss the unjust enrichment claim because the only harm [2] plaintiff seeks restitution for under this claim is the same harm he seeks damages for. Given the [3] duplicative nature of the remedies sought, MarinHealth argues the unjust enrichment claim must [4] be dismissed under Sonner v. Premier Nutrition Corp., 971 F.3d 834 (9th Cir. 2020). He also [5] argues that to the extent plaintiff is seeking restitutionary disgorgement under an unjust [6] enrichment theory, that is the same relief he seeks under his UCL claim and, therefore, the unjust [7] enrichment claim should be dismissed as redundant. [8] With respect to Sonner, I have repeatedly held that at the pleading stage all a plaintiff [9] needs to allege is inadequate remedies at law to pursue equitable claims. See, e.g., Brown v. Van's [10] Int'l Foods, Inc., No. 22-CV-00001-WHO, 2022 WL 1471454 , at *13 (N.D. Cal. May 10, 2022) [11] (“Once the plaintiff has met her burden to plead the inadequacy of legal remedies, it will typically [12] make sense to defer the determination of whether—on the particular facts of a particular case and [13] in light of how the evidence develops—a plaintiff's legal remedies will ultimately be adequate. It [14] will suffice at the pleading stage for plaintiff to plead that her legal remedies are inadequate or [15] plead equitable claims in the alternative because her legal remedies are inadequate.”). Plaintiff has [16] done that. Compl. ¶ 303. And with respect to the contention that his unjust enrichment claim is [17] duplicative of the relief available under the UCL claim, plaintiff responds that under unjust [18] enrichment he seeks non-restitutionary disgorgement, which is a type of relief that is not available [19] under the UCL. See Korea Supply Co. v. Lockheed Martin Corp., 29 Cal. 4th 1134, 1148 (2003). [20] Here, where plaintiff has alleged insufficient remedies as a matter of law and where [21] plaintiff is seeking restitution not allowed under the UCL, I will not dismiss an unjust enrichment [22] claim at the pleading stage. MarinHealth may rest assured that if this claim carries weight, during [23] any equitable phase I will ensure that plaintiff cannot rest on it to secure a “windfall.” See [24] Lanovaz v. Twinings N. Am., Inc., No. 12-CV-02646-R, 2015 WL 729705 , at *2 (N.D. Cal. Feb. [25] 19, 2015) (noting that courts can limit or deny disgorgement to the extent “it would result in an [26] inappropriate windfall to the claimant, or would otherwise be inequitable in a particular case”). [27] 1 CONCLUSION 2 The negligence claims is DISMISSED with leave to amend. The remainder of the motion 3 || to dismiss is DENIED. Plaintiff shall file his Amended Complaint within twenty (20) days of the 4 || date of this Order. 5 IT IS SO ORDERED. 6 || Dated: January 19, 2024 [7] Iham H. Orrick 9 United States District Judge [13] © [16] = 17 Z 18